CISA adds an actively exploited WordPress Core flaw to its KEV catalog, and a day of supply-chain and credential compromises

CISA added one vulnerability to its Known Exploited Vulnerabilities catalog on 3 November, based on evidence of active exploitation: a WordPress Core time-of-check time-of-use (TOCTOU) race condition vulnerability. CISA's alert says this class of flaw "is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise." Federal Civilian Executive Branch agencies must remediate under Binding Operational Directive 26-04; anyone running WordPress Core should match their estate against the advisory and apply the vendor's fix. If you run WordPress, treat this as the day's priority.

Two supply-chain-style compromises hit software you trust by default. BleepingComputer reported that attackers hijacked the autoupdate infrastructure of the cPGuard web security suite to push a backdoor and a data-stealing script to users. Separately, The Hacker News reported that an email sent on 3 November in the name of mSeven Software urged customers of the mSecure password manager to change passwords, reset two-factor authentication, and remove passkeys after suspicious activity. If you use either product, act on the vendor's instructions now.

Two breaches stemmed from compromised access. SecurityWeek reported that Frontline Education suffered a data breach affecting over 1.3 million people, after hackers exploited a flaw in third-party software and stole personal information on school district staff and students. BleepingComputer reported that WorkOS was breached after a threat actor accessed business contact records and customer communication summaries, with WorkOS saying the attacker used the ARTEX AI tool to breach an internal sales app.

Binance says North Korean hackers used a fake job interview to trick an employee into installing malware, ultimately compromising the exchange's wallet infrastructure and stealing about $6.34 billion in digital assets, as reported by BleepingComputer and The Register.

In takedowns and enforcement: The Record and Krebs on Security reported that Google and industry partners dismantled a botnet of more than 1.3 million Android TV set-top boxes — plus other Android IoT devices including telehealth devices and digital signage — that rented out users' connections and ran ad fraud. Help Net Security reported Europol-linked action seizing over 100 servers and arresting seven people tied to an investment fraud network with more than €4 million in losses. BleepingComputer reported that Google put LLMjacking cloud-AI fraud at over $1 million, with some organisations losing more than $100,000 per day. The Record also reported that German lawmakers and foreign policy staff were among Apple's recent spyware warning recipients across 99 countries.